Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

win102

windows10_x64

8

win104

windows10_x64

10

win105

windows10_x64

10

win106

windows10_x64

8

win103

windows10_x64

10

win101

windows10_x64

8

win100

windows10_x64

10

Resubmissions

24-05-2021 05:31

210524-b4dx7j71fj 10

21-05-2021 13:30

210521-r42mg8cghe 10

Analysis

  • max time kernel
    1798s
  • max time network
    1438s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-05-2021 13:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    keygen-step-4.exe

  • Size

    5.6MB

  • MD5

    a110ce3f7366c6bb12553ea17a793110

  • SHA1

    8e10076496347d6324382f20968f3b7c8516eedf

  • SHA256

    0e63f296fdc309cb1e487cd1a549d029d2a9144b8a050db274901030dc6ec0f3

  • SHA512

    dc9103da71a1143365f3c7f39c4a316a9b9cc6e337b601a95d13d68bba777d2145d79a9d44ac96edce71775819e4d4bb2bb0cf7e49627163237ec3580b25c3cf

Score
10/10
plugxredlineservlyla2evasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

redline

Botnet

ServLyla2

C2

87.251.71.4:80

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Executes dropped EXE 8 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2712
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2688
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2672
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2404
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2364
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1896
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1456
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1272
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1264
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1068
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:948
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:1000
                        • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
                          "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3736
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:3904
                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser
                              3⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2728
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2724
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1016
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3520
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of WriteProcessMemory
                            PID:2720
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              PID:1916
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3340
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1804
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:808
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3692
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4056

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/948-163-0x000001AB52320000-0x000001AB52390000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/948-248-0x000001AB52450000-0x000001AB524C0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1000-139-0x00000173E0C60000-0x00000173E0CD0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1000-240-0x00000173E0CD0000-0x00000173E0D40000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1016-200-0x0000000005550000-0x0000000005B56000-memory.dmp

                          Filesize

                          6.0MB

                          Download

                        • memory/1016-185-0x0000000005B60000-0x0000000005B61000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1016-186-0x0000000005610000-0x0000000005611000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1016-214-0x0000000005920000-0x0000000005921000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1016-201-0x00000000056B0000-0x00000000056B1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1016-178-0x0000000000400000-0x000000000041C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/1016-188-0x0000000005670000-0x0000000005671000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1068-246-0x0000024ECFDE0000-0x0000024ECFE50000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1068-158-0x0000024ECFD70000-0x0000024ECFDE0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1264-195-0x0000016E182C0000-0x0000016E18330000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1264-256-0x0000016E188A0000-0x0000016E18910000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1272-254-0x000001F4E1330000-0x000001F4E13A0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1272-193-0x000001F4E1270000-0x000001F4E12E0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1456-250-0x000002F2DE7B0000-0x000002F2DE820000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1456-187-0x000002F2DDC80000-0x000002F2DDCF0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1896-252-0x000001B9A25B0000-0x000001B9A2620000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1896-191-0x000001B9A2080000-0x000001B9A20F0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2364-242-0x000001453F1A0000-0x000001453F210000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2364-145-0x000001453EC90000-0x000001453ED00000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2364-142-0x000001453E950000-0x000001453E99B000-memory.dmp

                          Filesize

                          300KB

                          Download

                        • memory/2404-244-0x00000159FAF90000-0x00000159FB000000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2404-151-0x00000159FAF10000-0x00000159FAF80000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2672-156-0x000001C08D3A0000-0x000001C08D410000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2672-238-0x000001C08D480000-0x000001C08D4F0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2688-197-0x000001E560940000-0x000001E5609B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2688-258-0x000001E560E00000-0x000001E560E70000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2712-199-0x000001FF69A60000-0x000001FF69AD0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2712-260-0x000001FF6A040000-0x000001FF6A0B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2724-152-0x00000000026A0000-0x00000000026A1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2724-138-0x0000000000C90000-0x0000000000C99000-memory.dmp

                          Filesize

                          36KB

                          Download

                        • memory/2724-128-0x0000000000450000-0x0000000000451000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2728-137-0x0000000004E88000-0x0000000004F89000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/2728-140-0x0000000005050000-0x00000000050AC000-memory.dmp

                          Filesize

                          368KB

                          Download

                        • memory/3520-208-0x00000000037E0000-0x00000000037F0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/3520-202-0x0000000003640000-0x0000000003650000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/3520-189-0x0000000000400000-0x00000000005DB000-memory.dmp

                          Filesize

                          1.9MB

                          Download

                        • memory/3692-148-0x000001F77D600000-0x000001F77D670000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/4056-164-0x00000205D9270000-0x00000205D92E0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/4056-231-0x00000205DB800000-0x00000205DB906000-memory.dmp

                          Filesize

                          1.0MB

                          Download